blob: e3c0a40909f7a3fee445b1e192ad02c9f3e713e0 [file] [log] [blame]
* Here's a sample kernel module showing the use of jprobes to dump
* the arguments of _do_fork().
* For more information on theory of operation of jprobes, see
* Documentation/kprobes.txt
* Build and insert the kernel module as done in the kprobe example.
* You will see the trace data in /var/log/messages and on the
* console whenever _do_fork() is invoked to create a new process.
* (Some messages may be suppressed if syslogd is configured to
* eliminate duplicate messages.)
#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/kprobes.h>
* Jumper probe for _do_fork.
* Mirror principle enables access to arguments of the probed routine
* from the probe handler.
/* Proxy routine having the same arguments as actual _do_fork() routine */
static long j_do_fork(unsigned long clone_flags, unsigned long stack_start,
unsigned long stack_size, int __user *parent_tidptr,
int __user *child_tidptr, unsigned long tls)
pr_info("jprobe: clone_flags = 0x%lx, stack_start = 0x%lx "
"stack_size = 0x%lx\n", clone_flags, stack_start, stack_size);
/* Always end with a call to jprobe_return(). */
return 0;
static struct jprobe my_jprobe = {
.entry = j_do_fork,
.kp = {
.symbol_name = "_do_fork",
static int __init jprobe_init(void)
int ret;
ret = register_jprobe(&my_jprobe);
if (ret < 0) {
pr_err("register_jprobe failed, returned %d\n", ret);
return -1;
pr_info("Planted jprobe at %p, handler addr %p\n",, my_jprobe.entry);
return 0;
static void __exit jprobe_exit(void)
pr_info("jprobe at %p unregistered\n",;